1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 #ifndef _XFRM_CONTROLLER_H 17 #define _XFRM_CONTROLLER_H 18 19 #include <atomic> 20 #include <list> 21 #include <map> 22 #include <string> 23 #include <utility> // for pair 24 25 #include <linux/if.h> 26 #include <linux/if_link.h> 27 #include <linux/if_tunnel.h> 28 #include <linux/netlink.h> 29 #include <linux/udp.h> 30 #include <linux/xfrm.h> 31 #include <unistd.h> 32 33 #include "NetdConstants.h" 34 #include "android-base/unique_fd.h" 35 #include "netdutils/DumpWriter.h" 36 #include "netdutils/Slice.h" 37 #include "netdutils/Status.h" 38 #include "sysutils/SocketClient.h" 39 40 namespace android { 41 namespace net { 42 43 // Exposed for testing 44 extern const uint32_t ALGO_MASK_AUTH_ALL; 45 // Exposed for testing 46 extern const uint32_t ALGO_MASK_CRYPT_ALL; 47 // Exposed for testing 48 extern const uint32_t ALGO_MASK_AEAD_ALL; 49 // Exposed for testing 50 extern const uint8_t REPLAY_WINDOW_SIZE; 51 52 // Suggest we avoid the smallest and largest ints 53 class XfrmMessage; 54 class TransportModeSecurityAssociation; 55 56 class XfrmSocket { 57 public: 58 // called from destructor and thus cannot be virtual close()59 void close() { 60 if (mSock >= 0) { 61 ::close(mSock); 62 } 63 mSock = -1; 64 } 65 66 virtual netdutils::Status open() = 0; 67 ~XfrmSocket()68 virtual ~XfrmSocket() { close(); } 69 70 // Sends the netlink message contained in iovecs. This populates iovecs[0] with 71 // a valid netlink message header. 72 virtual netdutils::Status sendMessage(uint16_t nlMsgType, uint16_t nlMsgFlags, 73 uint16_t nlMsgSeqNum, 74 std::vector<iovec>* iovecs) const = 0; 75 76 protected: 77 int mSock; 78 }; 79 80 enum struct XfrmDirection : uint8_t { 81 IN = XFRM_POLICY_IN, 82 OUT = XFRM_POLICY_OUT, 83 FORWARD = XFRM_POLICY_FWD, 84 MASK = XFRM_POLICY_MASK, 85 }; 86 87 enum struct XfrmMode : uint8_t { 88 TRANSPORT = XFRM_MODE_TRANSPORT, 89 TUNNEL = XFRM_MODE_TUNNEL, 90 }; 91 92 enum struct XfrmEncapType : uint16_t { 93 NONE = 0, 94 ESPINUDP_NON_IKE = UDP_ENCAP_ESPINUDP_NON_IKE, 95 ESPINUDP = UDP_ENCAP_ESPINUDP 96 }; 97 98 struct XfrmAlgo { 99 std::string name; 100 std::vector<uint8_t> key; 101 uint16_t truncLenBits; 102 }; 103 104 struct XfrmEncap { 105 XfrmEncapType type; 106 uint16_t srcPort; 107 uint16_t dstPort; 108 }; 109 110 struct XfrmEndpointPair { 111 xfrm_address_t dstAddr; // network order 112 xfrm_address_t srcAddr; 113 int addrFamily; // AF_INET or AF_INET6 114 }; 115 116 // minimally sufficient structure to match either an SA or a Policy 117 struct XfrmCommonInfo : XfrmEndpointPair { 118 int transformId; // requestId 119 int spi; 120 xfrm_mark mark; 121 int xfrm_if_id; 122 XfrmMode mode; 123 }; 124 125 struct XfrmSaInfo : XfrmCommonInfo { 126 XfrmAlgo auth; 127 XfrmAlgo crypt; 128 XfrmAlgo aead; 129 int netId; 130 XfrmEncap encap; 131 }; 132 133 struct XfrmSpInfo : XfrmCommonInfo { 134 // Address family in XfrmCommonInfo used for template/SA matching, need separate addrFamily 135 // for selectors 136 int selAddrFamily; // AF_INET or AF_INET6 137 XfrmDirection direction; 138 }; 139 140 struct XfrmMigrateInfo : XfrmSpInfo { 141 XfrmEndpointPair newEndpointInfo; 142 }; 143 144 /* 145 * This is a workaround for a kernel bug in the 32bit netlink compat layer 146 * that has been present on x86_64 kernels since 2010 with no fix on the 147 * horizon. 148 * 149 * Below is a redefinition of the xfrm_usersa_info struct that is part 150 * of the Linux uapi <linux/xfrm.h> to align the structures to a 64-bit 151 * boundary. 152 * 153 * Note that we turn this on for all x86 32bit targets, under the assumption 154 * that nowadays all x86 targets are running 64bit kernels. 155 */ 156 #if defined(__i386__) 157 // Shadow the kernel definition of xfrm_usersa_info with a 64-bit aligned version 158 struct xfrm_usersa_info : ::xfrm_usersa_info { 159 } __attribute__((aligned(8))); 160 // Shadow the kernel's version, using the aligned version of xfrm_usersa_info 161 struct xfrm_userspi_info { 162 struct xfrm_usersa_info info; 163 __u32 min; 164 __u32 max; 165 }; 166 struct xfrm_userpolicy_info : ::xfrm_userpolicy_info { 167 } __attribute__((aligned(8))); 168 169 /* 170 * Anyone who encounters a failure when sending netlink messages should look here 171 * first. Hitting the static_assert() below should be a strong hint that Android 172 * IPsec will probably not work with your current settings. 173 * 174 * Again, experimentally determined, the "flags" field should be the first byte in 175 * the final word of the xfrm_usersa_info struct. The check validates the size of 176 * the padding to be 7. 177 * 178 * This padding is verified to be correct on gcc/x86_64 kernel, and clang/x86 userspace. 179 */ 180 static_assert(sizeof(::xfrm_usersa_info) % 8 != 0, 181 "struct xfrm_usersa_info has changed " 182 "alignment. Please consider whether this " 183 "patch is needed."); 184 static_assert(sizeof(xfrm_usersa_info) - offsetof(xfrm_usersa_info, flags) == 8, 185 "struct xfrm_usersa_info probably misaligned with kernel struct."); 186 static_assert(sizeof(xfrm_usersa_info) % 8 == 0, 187 "struct xfrm_usersa_info_t is not 64-bit " 188 "aligned. Please consider whether this patch " 189 "is needed."); 190 static_assert(sizeof(::xfrm_userspi_info) - sizeof(::xfrm_usersa_info) == 191 sizeof(xfrm_userspi_info) - sizeof(xfrm_usersa_info), 192 "struct xfrm_userspi_info has changed and does not match the kernel struct."); 193 static_assert(sizeof(::xfrm_userpolicy_info) % 8 != 0, 194 "struct xfrm_userpolicy_info has changed " 195 "alignment. Please consider whether this " 196 "patch is needed."); 197 static_assert(sizeof(xfrm_userpolicy_info) - offsetof(xfrm_userpolicy_info, share) == 5, 198 "struct xfrm_userpolicy_info probably misaligned with kernel struct."); 199 static_assert(sizeof(xfrm_userpolicy_info) % 8 == 0, 200 "struct xfrm_userpolicy_info is not 64-bit " 201 "aligned. Please consider whether this patch " 202 "is needed."); 203 #endif 204 205 class XfrmController { 206 public: 207 XfrmController(); 208 209 // Initializer to override XFRM-I support for unit-testing purposes 210 explicit XfrmController(bool xfrmIntfSupport); 211 212 static netdutils::Status Init(); 213 214 static netdutils::Status ipSecSetEncapSocketOwner(int socketFd, int newUid, uid_t callerUid); 215 216 static netdutils::Status ipSecAllocateSpi(int32_t transformId, const std::string& localAddress, 217 const std::string& remoteAddress, int32_t inSpi, 218 int32_t* outSpi); 219 220 static netdutils::Status ipSecAddSecurityAssociation( 221 int32_t transformId, int32_t mode, const std::string& sourceAddress, 222 const std::string& destinationAddress, int32_t underlyingNetId, int32_t spi, 223 int32_t markValue, int32_t markMask, const std::string& authAlgo, 224 const std::vector<uint8_t>& authKey, int32_t authTruncBits, 225 const std::string& cryptAlgo, const std::vector<uint8_t>& cryptKey, 226 int32_t cryptTruncBits, const std::string& aeadAlgo, 227 const std::vector<uint8_t>& aeadKey, int32_t aeadIcvBits, int32_t encapType, 228 int32_t encapLocalPort, int32_t encapRemotePort, int32_t xfrmInterfaceId); 229 230 static netdutils::Status ipSecDeleteSecurityAssociation(int32_t transformId, 231 const std::string& sourceAddress, 232 const std::string& destinationAddress, 233 int32_t spi, int32_t markValue, 234 int32_t markMask, 235 int32_t xfrmInterfaceId); 236 237 static netdutils::Status ipSecApplyTransportModeTransform(int socketFd, int32_t transformId, 238 int32_t direction, 239 const std::string& localAddress, 240 const std::string& remoteAddress, 241 int32_t spi); 242 243 static netdutils::Status ipSecRemoveTransportModeTransform(int socketFd); 244 245 static netdutils::Status ipSecAddSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 246 int32_t direction, 247 const std::string& tmplSrcAddress, 248 const std::string& tmplDstAddress, int32_t spi, 249 int32_t markValue, int32_t markMask, 250 int32_t xfrmInterfaceId); 251 252 static netdutils::Status ipSecUpdateSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 253 int32_t direction, 254 const std::string& tmplSrcAddress, 255 const std::string& tmplDstAddress, 256 int32_t spi, int32_t markValue, 257 int32_t markMask, int32_t xfrmInterfaceId); 258 259 static netdutils::Status ipSecDeleteSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 260 int32_t direction, int32_t markValue, 261 int32_t markMask, int32_t xfrmInterfaceId); 262 263 static netdutils::Status ipSecAddTunnelInterface(const std::string& deviceName, 264 const std::string& localAddress, 265 const std::string& remoteAddress, int32_t ikey, 266 int32_t okey, int32_t interfaceId, 267 bool isUpdate); 268 269 static netdutils::Status ipSecRemoveTunnelInterface(const std::string& deviceName); 270 271 // Only available for Tunnel must already have a matching tunnel SA and policy 272 static netdutils::Status ipSecMigrate(int32_t transformId, int32_t selAddrFamily, 273 int32_t direction, const std::string& oldSourceAddress, 274 const std::string& oldDestinationAddress, 275 const std::string& newSourceAddress, 276 const std::string& newDestinationAddress, 277 int32_t xfrmInterfaceId); 278 void dump(netdutils::DumpWriter& dw); 279 280 // Some XFRM netlink attributes comprise a header, a struct, and some data 281 // after the struct. We wrap all of those in one struct for easier 282 // marshalling. The structs below must be ABI compatible with the kernel and 283 // are composed from kernel structures; thus, they use the kernel naming 284 // convention. 285 286 // Exposed for testing 287 static constexpr size_t MAX_KEY_LENGTH = 128; 288 289 // Container for the content of an XFRMA_ALG_CRYPT netlink attribute. 290 // Exposed for testing 291 struct nlattr_algo_crypt { 292 nlattr hdr; 293 xfrm_algo crypt; 294 uint8_t key[MAX_KEY_LENGTH]; 295 }; 296 297 // Container for the content of an XFRMA_ALG_AUTH_TRUNC netlink attribute. 298 // Exposed for testing 299 struct nlattr_algo_auth { 300 nlattr hdr; 301 xfrm_algo_auth auth; 302 uint8_t key[MAX_KEY_LENGTH]; 303 }; 304 305 // Container for the content of an XFRMA_TMPL netlink attribute. 306 // Exposed for testing 307 struct nlattr_algo_aead { 308 nlattr hdr; 309 xfrm_algo_aead aead; 310 uint8_t key[MAX_KEY_LENGTH]; 311 }; 312 313 // Exposed for testing 314 struct nlattr_user_tmpl { 315 nlattr hdr; 316 xfrm_user_tmpl tmpl; 317 }; 318 319 // Container for the content of an XFRMA_ENCAP netlink attribute. 320 // Exposed for testing 321 struct nlattr_encap_tmpl { 322 nlattr hdr; 323 xfrm_encap_tmpl tmpl; 324 }; 325 326 // Container for the content of an XFRMA_MARK netlink attribute. 327 // Exposed for testing 328 struct nlattr_xfrm_mark { 329 nlattr hdr; 330 xfrm_mark mark; 331 }; 332 333 // Container for the content of an XFRMA_OUTPUT_MARK netlink attribute. 334 // Exposed for testing 335 struct nlattr_xfrm_output_mark { 336 nlattr hdr; 337 __u32 outputMark; 338 }; 339 340 // Container for the content of an XFRMA_IF_ID netlink attribute. 341 // Exposed for testing 342 struct nlattr_xfrm_interface_id { 343 nlattr hdr; 344 __u32 if_id; 345 }; 346 347 // Container for the content of an XFRMA_MIGRATE netlink attribute. 348 // Exposed for testing 349 struct nlattr_xfrm_user_migrate { 350 nlattr hdr; 351 xfrm_user_migrate migrate; 352 }; 353 354 // Exposed for testing 355 struct nlattr_payload_u32 { 356 nlattr hdr; 357 uint32_t value; 358 }; 359 360 private: 361 static bool isXfrmIntfSupported(); 362 363 static netdutils::Status fillXfrmEndpointPair(const std::string& sourceAddress, 364 const std::string& destinationAddress, 365 XfrmEndpointPair* info); 366 // helper functions for filling in the XfrmCommonInfo (and XfrmSaInfo) structure 367 static netdutils::Status fillXfrmCommonInfo(const std::string& sourceAddress, 368 const std::string& destinationAddress, int32_t spi, 369 int32_t markValue, int32_t markMask, 370 int32_t transformId, int32_t xfrmInterfaceId, 371 XfrmCommonInfo* info); 372 static netdutils::Status fillXfrmCommonInfo(int32_t spi, int32_t markValue, int32_t markMask, 373 int32_t transformId, int32_t xfrmInterfaceId, 374 XfrmCommonInfo* info); 375 376 // Top level functions for managing a Transport Mode Transform 377 static netdutils::Status addTransportModeTransform(const XfrmSaInfo& record); 378 static int removeTransportModeTransform(const XfrmSaInfo& record); 379 380 // TODO(messagerefactor): FACTOR OUT ALL MESSAGE BUILDING CODE BELOW HERE 381 // Shared between SA and SP 382 static void fillXfrmSelector(const int record, xfrm_selector* selector); 383 384 // Shared between Transport and Tunnel Mode 385 static int fillNlAttrXfrmAlgoEnc(const XfrmAlgo& in_algo, nlattr_algo_crypt* algo); 386 static int fillNlAttrXfrmAlgoAuth(const XfrmAlgo& in_algo, nlattr_algo_auth* algo); 387 static int fillNlAttrXfrmAlgoAead(const XfrmAlgo& in_algo, nlattr_algo_aead* algo); 388 static int fillNlAttrXfrmEncapTmpl(const XfrmSaInfo& record, nlattr_encap_tmpl* tmpl); 389 390 // Functions for updating a Transport Mode SA 391 static netdutils::Status updateSecurityAssociation(const XfrmSaInfo& record, 392 const XfrmSocket& sock); 393 static int fillUserSaInfo(const XfrmSaInfo& record, xfrm_usersa_info* usersa); 394 395 // Functions for deleting a Transport Mode SA 396 static netdutils::Status deleteSecurityAssociation(const XfrmCommonInfo& record, 397 const XfrmSocket& sock); 398 static int fillUserSaId(const XfrmCommonInfo& record, xfrm_usersa_id* said); 399 static void fillUserTemplate(const XfrmSpInfo& record, xfrm_user_tmpl* tmpl); 400 401 static int fillUserSpInfo(const XfrmSpInfo& record, xfrm_userpolicy_info* usersp); 402 static int fillNlAttrUserTemplate(const XfrmSpInfo& record, nlattr_user_tmpl* tmpl); 403 static int fillUserPolicyId(const XfrmSpInfo& record, xfrm_userpolicy_id* policy_id); 404 static int fillNlAttrXfrmMark(const XfrmCommonInfo& record, nlattr_xfrm_mark* mark); 405 static int fillNlAttrXfrmOutputMark(const XfrmSaInfo& record, 406 nlattr_xfrm_output_mark* output_mark); 407 static int fillNlAttrXfrmIntfId(const __u32 intf_id_value, nlattr_xfrm_interface_id* intf_id); 408 static int fillNlAttrXfrmMigrate(const XfrmMigrateInfo& record, 409 nlattr_xfrm_user_migrate* migrate); 410 411 static netdutils::Status allocateSpi(const XfrmSaInfo& record, uint32_t minSpi, uint32_t maxSpi, 412 uint32_t* outSpi, const XfrmSocket& sock); 413 414 static netdutils::Status processSecurityPolicy(int32_t transformId, int32_t selAddrFamily, 415 int32_t direction, 416 const std::string& tmplSrcAddress, 417 const std::string& tmplDstAddress, int32_t spi, 418 int32_t markValue, int32_t markMask, 419 int32_t xfrmInterfaceId, int32_t msgType); 420 static netdutils::Status updateTunnelModeSecurityPolicy(const XfrmSpInfo& record, 421 const XfrmSocket& sock, 422 uint16_t msgType); 423 static netdutils::Status deleteTunnelModeSecurityPolicy(const XfrmSpInfo& record, 424 const XfrmSocket& sock); 425 static netdutils::Status migrate(const XfrmMigrateInfo& record, const XfrmSocket& sock); 426 static netdutils::Status flushInterfaces(); 427 static netdutils::Status flushSaDb(const XfrmSocket& s); 428 static netdutils::Status flushPolicyDb(const XfrmSocket& s); 429 430 static netdutils::Status ipSecAddXfrmInterface(const std::string& deviceName, 431 int32_t interfaceId, uint16_t flags); 432 static netdutils::Status ipSecAddVirtualTunnelInterface(const std::string& deviceName, 433 const std::string& localAddress, 434 const std::string& remoteAddress, 435 int32_t ikey, int32_t okey, 436 uint16_t flags); 437 // END TODO(messagerefactor) 438 }; 439 440 } // namespace net 441 } // namespace android 442 443 #endif /* !defined(XFRM_CONTROLLER_H) */ 444